Bug 182965 - [FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)
Summary: [FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Yusuke Suzuki
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-02-20 04:56 PST by Yusuke Suzuki
Modified: 2018-02-27 22:47 PST (History)
6 users (show)

See Also:


Attachments
Patch (15.45 KB, patch)
2018-02-20 04:56 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (20.42 KB, patch)
2018-02-22 02:16 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (21.71 KB, patch)
2018-02-25 22:59 PST, Yusuke Suzuki
sbarati: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Yusuke Suzuki 2018-02-20 04:56:08 PST
[FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)
Comment 1 Yusuke Suzuki 2018-02-20 04:56:23 PST
Created attachment 334260 [details]
Patch
Comment 2 EWS Watchlist 2018-02-20 04:59:29 PST
Attachment 334260 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084:  Wrong number of spaces before statement. (expected: 24)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4196:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4196:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4222:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4222:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
Total errors found: 10 in 7 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 3 Yusuke Suzuki 2018-02-22 02:16:57 PST
Created attachment 334444 [details]
Patch
Comment 4 EWS Watchlist 2018-02-22 02:19:49 PST
Attachment 334444 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084:  Wrong number of spaces before statement. (expected: 24)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4196:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4196:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4222:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4222:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
Total errors found: 10 in 10 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 5 Yusuke Suzuki 2018-02-25 22:59:41 PST
Created attachment 334592 [details]
Patch
Comment 6 EWS Watchlist 2018-02-25 23:01:57 PST
Attachment 334592 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084:  Wrong number of spaces before statement. (expected: 24)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4199:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4199:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4225:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4225:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3077:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161:  Wrong number of spaces before statement. (expected: 28)  [whitespace/indent] [4]
ERROR: Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:3161:  Comma should be at the beginning of the line in a member initialization list.  [whitespace/init] [4]
Total errors found: 10 in 11 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 7 Yusuke Suzuki 2018-02-26 06:06:40 PST
Comment on attachment 334592 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review

> Source/JavaScriptCore/ChangeLog:11
> +        This is the last change for FTL to support all the types of DFG nodes.

Except for CreateThis. I’ll change ths part later.
Comment 8 Saam Barati 2018-02-26 09:00:26 PST
(In reply to Yusuke Suzuki from comment #7)
> Comment on attachment 334592 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=334592&action=review
> 
> > Source/JavaScriptCore/ChangeLog:11
> > +        This is the last change for FTL to support all the types of DFG nodes.
> 
> Except for CreateThis. I’ll change ths part later.

FYI, adding CreateThis will lead to a performance regression, or at least it did when I added it. I remember it ended up having some effects on ICs which made certain GetByOffsets turn into GetByOd, which caused object allocation sinking to not kick in.
Comment 9 Saam Barati 2018-02-26 09:02:59 PST
(In reply to Saam Barati from comment #8)
> (In reply to Yusuke Suzuki from comment #7)
> > Comment on attachment 334592 [details]
> > Patch
> > 
> > View in context:
> > https://bugs.webkit.org/attachment.cgi?id=334592&action=review
> > 
> > > Source/JavaScriptCore/ChangeLog:11
> > > +        This is the last change for FTL to support all the types of DFG nodes.
> > 
> > Except for CreateThis. I’ll change ths part later.
> 
> FYI, adding CreateThis will lead to a performance regression, or at least it
> did when I added it. I remember it ended up having some effects on ICs which
> made certain GetByOffsets turn into GetByOd, which caused object allocation
> sinking to not kick in.

See:
https://bugs.webkit.org/show_bug.cgi?id=164904
Comment 10 Saam Barati 2018-02-26 12:35:22 PST
Comment on attachment 334592 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review

r=me

> Source/JavaScriptCore/dfg/DFGOperations.cpp:810
> +void JIT_OPERATION operationPutDoubleByValDirectBeyondArrayBoundsStrict(ExecState* exec, JSObject* array, int32_t index, double value)

Is this actually guaranteed to be a JSArray* here? If so, I'd give it that type. Otherwise, perhaps just name the variable "object".

> Source/JavaScriptCore/dfg/DFGOperations.cpp:826
> +void JIT_OPERATION operationPutDoubleByValDirectBeyondArrayBoundsNonStrict(ExecState* exec, JSObject* array, int32_t index, double value)

ditto

> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084
> +                m_jit.codeBlock()->isStrictMode()
> +                    ? (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsStrict : operationPutDoubleByValBeyondArrayBoundsStrict)
> +                    : (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsNonStrict : operationPutDoubleByValBeyondArrayBoundsNonStrict),

Was this doing the wrong thing before?

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4274
> +            LBasicBlock notHoleCase = m_out.newBlock();

nit: This isn't really "notHoleCase" since the hole case may jump here. I'd call this "doStoreCase" or something like that

> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300
> +                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),

Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly?
Comment 11 Yusuke Suzuki 2018-02-26 23:26:52 PST
Comment on attachment 334592 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review

>>>> Source/JavaScriptCore/ChangeLog:11
>>>> +        This is the last change for FTL to support all the types of DFG nodes.
>>> 
>>> Except for CreateThis. I’ll change ths part later.
>> 
>> FYI, adding CreateThis will lead to a performance regression, or at least it did when I added it. I remember it ended up having some effects on ICs which made certain GetByOffsets turn into GetByOd, which caused object allocation sinking to not kick in.
> 
> See:
> https://bugs.webkit.org/show_bug.cgi?id=164904

Yeah

>> Source/JavaScriptCore/dfg/DFGOperations.cpp:810
>> +void JIT_OPERATION operationPutDoubleByValDirectBeyondArrayBoundsStrict(ExecState* exec, JSObject* array, int32_t index, double value)
> 
> Is this actually guaranteed to be a JSArray* here? If so, I'd give it that type. Otherwise, perhaps just name the variable "object".

Yeah, it would be JSObject* if the indexing type is NonArray.
I've changed the name to `object`.

>> Source/JavaScriptCore/dfg/DFGOperations.cpp:826
>> +void JIT_OPERATION operationPutDoubleByValDirectBeyondArrayBoundsNonStrict(ExecState* exec, JSObject* array, int32_t index, double value)
> 
> ditto

Fixed.

>> Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:2084
>> +                    : (node->op() == PutByValDirect ? operationPutDoubleByValDirectBeyondArrayBoundsNonStrict : operationPutDoubleByValBeyondArrayBoundsNonStrict),
> 
> Was this doing the wrong thing before?

No. Basically, this was OK. But for consistency, I've introduced this.
I described the detail in ChangeLog.

>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4274
>> +            LBasicBlock notHoleCase = m_out.newBlock();
> 
> nit: This isn't really "notHoleCase" since the hole case may jump here. I'd call this "doStoreCase" or something like that

OK, changed it to `doStoreCase`.

>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300
>> +                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
> 
> Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly?

Sounds nice. Fixed.
Comment 12 Yusuke Suzuki 2018-02-26 23:32:20 PST
Committed r229053: <https://trac.webkit.org/changeset/229053>
Comment 13 Radar WebKit Bug Importer 2018-02-26 23:33:37 PST
<rdar://problem/37932289>
Comment 14 Saam Barati 2018-02-27 21:05:09 PST
Comment on attachment 334592 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review

>>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300
>>> +                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
>> 
>> Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly?
> 
> Sounds nice. Fixed.

Actually, maybe I’m wrong here. We need to make sure everywhere someone uses publicLength for butterfly of array storage, they use this new field. Otherwise, the B3 might think these fields don’t alias, and will make optimizations that may break programs. We should probably go back to what you had before actually, unless we fix all sites that use it as well. Seems easier to just revert. WDYT?
Comment 15 Yusuke Suzuki 2018-02-27 22:38:22 PST
Comment on attachment 334592 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334592&action=review

>>>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300
>>>> +                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
>>> 
>>> Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly?
>> 
>> Sounds nice. Fixed.
> 
> Actually, maybe I’m wrong here. We need to make sure everywhere someone uses publicLength for butterfly of array storage, they use this new field. Otherwise, the B3 might think these fields don’t alias, and will make optimizations that may break programs. We should probably go back to what you had before actually, unless we fix all sites that use it as well. Seems easier to just revert. WDYT?

Yeah, because of this, my landing patch makes ArrayStorage_vectorLength and ArrayStorage_publicLength as complete alias to Butterfly_vectorLength and Butterfly_publicLength. https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp#L62-L63
So I think it is OK.
Comment 16 Saam Barati 2018-02-27 22:47:50 PST
(In reply to Yusuke Suzuki from comment #15)
> Comment on attachment 334592 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=334592&action=review
> 
> >>>> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:4300
> >>>> +                        index, m_out.load32NonNegative(storage, m_heaps.Butterfly_publicLength)),
> >>> 
> >>> Is it worth defining an ArrayStorage_publicLength just in case someone changes the memory layout to not be the same as Butterfly?
> >> 
> >> Sounds nice. Fixed.
> > 
> > Actually, maybe I’m wrong here. We need to make sure everywhere someone uses publicLength for butterfly of array storage, they use this new field. Otherwise, the B3 might think these fields don’t alias, and will make optimizations that may break programs. We should probably go back to what you had before actually, unless we fix all sites that use it as well. Seems easier to just revert. WDYT?
> 
> Yeah, because of this, my landing patch makes ArrayStorage_vectorLength and
> ArrayStorage_publicLength as complete alias to Butterfly_vectorLength and
> Butterfly_publicLength.
> https://github.com/WebKit/webkit/blob/master/Source/JavaScriptCore/ftl/
> FTLAbstractHeapRepository.cpp#L62-L63
> So I think it is OK.

👍🏽